admin_suite 0.5.0 → 0.6.2

data/lib/admin_suite.rb

@@ -8,6 +8,11 @@ end
 
 require "pagy"
 
+# Hard dependency, declared in the gemspec but not a direct Gemfile entry in
+# any host -- Bundler only auto-requires direct Gemfile dependencies, never a
+# gem's transitive runtime dependencies.
+require "mcp"
+
 # Hard dependency, declared in the gemspec but not a direct Gemfile entry in
 # any host -- Bundler's `Bundler.require` only auto-requires gems declared
 # directly in the Gemfile (or via `gemspec`'s own path entry), not a gem's
@@ -20,6 +25,15 @@ require "turbo-rails"
 require "admin_suite/version"
 require "admin_suite/deprecation"
 require "admin_suite/configuration"
+require "admin_suite/authorization_context"
+require "admin_suite/query"
+require "admin_suite/mcp/authorization"
+require "admin_suite/mcp/serializer"
+require "admin_suite/mcp/tools/describe_resources"
+require "admin_suite/mcp/tools/list_records"
+require "admin_suite/mcp/tools/get_record"
+require "admin_suite/mcp/tools/aggregate"
+require "admin_suite/mcp"
 require "admin_suite/markdown_renderer"
 require "admin_suite/theme_palette"
 require "admin_suite/portal_registry"
@@ -34,7 +48,6 @@ require "admin_suite/renderers/json_renderer"
 require "admin_suite/renderers/key_value_renderer"
 require "admin_suite/renderers/table_from_renderer"
 require "admin_suite/renderers/code_renderer"
-require "admin_suite/renderers/legacy_gleania"
 require "admin_suite/legacy_custom_renderer_procs"
 require "admin_suite/definition_loader"
 require "admin_suite/host_autoload_policy"
@@ -58,14 +71,6 @@ AdminSuite::RendererRegistry.register_default(:code, AdminSuite::Renderers::Code
 AdminSuite::RendererRegistry.register_default(:json_preview, AdminSuite::Renderers::JsonRenderer)
 AdminSuite::RendererRegistry.register_default(:code_preview, AdminSuite::Renderers::CodeRenderer)
 
-# Deprecated (removal targeted at 0.6.0, moved from the originally-planned
-# 0.5.0 -- both host migrations, gleania and trust_growth, are in flight):
-# the four Gleania-specific LLM chat-transcript renderers. See
-# `AdminSuite::Renderers::LegacyGleania` for details.
-AdminSuite::RendererRegistry.register_default(:prompt_template_preview, AdminSuite::Renderers::LegacyGleania::PromptTemplateRenderer)
-AdminSuite::RendererRegistry.register_default(:messages_preview, AdminSuite::Renderers::LegacyGleania::MessagesPreviewRenderer)
-AdminSuite::RendererRegistry.register_default(:tool_args_preview, AdminSuite::Renderers::LegacyGleania::ToolArgsRenderer)
-AdminSuite::RendererRegistry.register_default(:turn_messages_preview, AdminSuite::Renderers::LegacyGleania::TurnMessagesRenderer)
 
 module AdminSuite
   class << self

data/lib/generators/admin_suite/install/templates/admin_suite.rb

@@ -26,9 +26,12 @@ AdminSuite.configure do |config|
   # provide one (legacy fallback):
   config.current_actor = ->(controller) { controller.respond_to?(:current_user) ? controller.current_user : nil }
 
-  # Authorization hook — called for every resource request:
+  # Authorization hook — called for every resource request.
+  # Signature: ->(actor:, action:, resource:, record:, context:) { true }
   # action is one of :read, :create, :update, :destroy, :execute.
-  # config.authorize = ->(actor:, action:, resource:, record:, controller:) { true }
+  # nil hook: authenticated web requests are allowed; MCP serves no tools/data.
+  # Hook return of false or nil denies the request (no disclose/mutate).
+  # config.authorize = ->(actor:, action:, resource:, record:, context:) { actor&.admin? }
   config.authorize = nil
 
   # Optional sign-out action in the topbar.

data/test/archspec/enforcement_test.rb

@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+require "minitest/autorun" unless defined?(Rails)
+require "yaml"
+require "open3"
+require "tmpdir"
+require "fileutils"
+
+class ArchspecEnforcementTest < Minitest::Test
+  ROOT = File.expand_path("../..", __dir__)
+
+  def test_pull_request_architecture_job_is_fail_closed_and_matches_bin_ci
+    workflow = YAML.load_file(File.join(ROOT, ".github/workflows/ci.yml"))
+    job = workflow.fetch("jobs").fetch("architecture")
+    assert_equal "ubuntu-latest", job["runs-on"]
+    assert_nil job["continue-on-error"]
+    assert_nil job["if"]
+
+    commands = job.fetch("steps").filter_map { |step| step["run"] }
+    assert_includes commands, "bin/archspec check"
+    assert_includes commands, "bin/archspec-baseline"
+    assert commands.none? { |command| command.include?("continue-on-error") || command.include?("[ -f") }
+
+    ci = File.read(File.join(ROOT, "bin/ci"))
+    assert_includes ci, 'step "Architecture: ArchSpec" bin/archspec check'
+    assert_includes ci, 'step "Architecture: baseline cap" bin/archspec-baseline'
+    refute_match(/if \[ -f bin\/archspec \]/, ci)
+    refute_match(/if \[ -f Archspec\.rb \]/, ci)
+    assert_equal "read", job.dig("permissions", "contents")
+  end
+
+  def test_mcp_cannot_call_rejects_a_write
+    spec = File.read(File.join(ROOT, "Archspec.rb"))
+    rule = spec[/mcp\.cannot_call\b.*?receiver: :any/m]
+    assert rule, "mcp.cannot_call must forbid writes on any receiver"
+    refute_match(/ui\.cannot_call/, rule)
+    assert_match(/queries\.cannot_use\b[^\n]*:mcp\b/, spec)
+
+    Dir.mktmpdir do |dir|
+      FileUtils.mkdir_p(File.join(dir, "lib/admin_suite/mcp"))
+      File.write(File.join(dir, "Archspec.rb"), spec)
+      File.write(File.join(dir, "archspec_todo.yml"), File.read(File.join(ROOT, "archspec_todo.yml")))
+      File.write(File.join(dir, "lib/admin_suite/mcp/probe.rb"), <<~RUBY)
+        module AdminSuite
+          module Mcp
+            class Probe
+              def call(record)
+                record.save
+              end
+            end
+          end
+        end
+      RUBY
+
+      output, status = run_archspec(dir, "check")
+      refute status.success?, output
+      assert_match(/must not call #save/, output)
+    end
+  end
+
+  def test_missing_and_invalid_configuration_fail
+    Dir.mktmpdir do |dir|
+      _output, status = run_archspec(dir, "check", "--config", File.join(dir, "missing.rb"))
+      refute status.success?
+    end
+
+    Dir.mktmpdir do |dir|
+      File.write(File.join(dir, "Archspec.rb"), "this is not ruby (\n")
+      _output, status = run_archspec(dir, "check")
+      refute status.success?
+    end
+  end
+
+  def test_stale_baseline_id_fails_and_current_set_passes
+    Dir.mktmpdir do |dir|
+      FileUtils.mkdir_p(File.join(dir, "app/models"))
+      File.write(File.join(dir, "app/models/widget.rb"), "class Widget\nend\n")
+      File.write(File.join(dir, "Archspec.rb"), <<~CONFIG)
+        todo "archspec_todo.yml"
+        component :models, in: "app/models/**/*.rb"
+        models.cannot_reference_constants "Nope"
+      CONFIG
+      File.write(File.join(dir, "archspec_todo.yml"), <<~YAML)
+        ---
+        violations: []
+      YAML
+
+      _output, status = run_baseline(dir)
+      assert status.success?, "empty matching baseline must pass"
+
+      File.write(File.join(dir, "archspec_todo.yml"), <<~YAML)
+        ---
+        violations:
+        - id: deadbeefdeadbeefdeadbeef
+          rule: constants.forbid
+          path: app/models/widget.rb
+          line: 1
+          message: gone
+      YAML
+      output, status = run_baseline(dir)
+      refute status.success?
+      assert_match(/stale deadbeefdeadbeefdeadbeef/, output)
+    end
+  end
+
+  private
+
+  def run_archspec(dir, *args)
+    Open3.capture2e({ "BUNDLE_GEMFILE" => File.join(ROOT, "Gemfile") }, File.join(ROOT, "bin/archspec"), *args, chdir: dir)
+  end
+
+  def run_baseline(dir)
+    Open3.capture2e({ "BUNDLE_GEMFILE" => File.join(ROOT, "Gemfile") }, File.join(ROOT, "bin/archspec-baseline"), chdir: dir)
+  end
+end

data/test/controllers/resources_controller_test.rb

@@ -6,12 +6,7 @@ module AdminSuite
   class ResourcesControllerTest < ActiveSupport::TestCase
     class TestController < ResourcesController
       attr_writer :test_resource_config, :test_params
-      attr_reader :filter_calls, :paginated_scope
-
-      def initialize
-        super
-        @filter_calls = 0
-      end
+      attr_reader :paginated_scope, :pagy_limit
 
       def params
         @test_params ||= {}
@@ -23,18 +18,27 @@ module AdminSuite
         @test_resource_config
       end
 
-      def filtered_collection
-        @filter_calls += 1
-        { total: 37 }
-      end
-
-      def paginate_collection(scope)
+      def pagy(scope, limit:)
         @paginated_scope = scope
+        @pagy_limit = limit
         [ Object.new, :paginated ]
       end
     end
 
+    class StatsModel
+      class << self
+        attr_accessor :all_calls
+
+        def all
+          self.all_calls = all_calls.to_i + 1
+          { total: 37 }
+        end
+      end
+    end
+
     class StatsResource < Admin::Base::Resource
+      model StatsModel
+
       index do
         stats do
           stat :legacy, -> { 11 }
@@ -72,11 +76,13 @@ module AdminSuite
     test "index reuses one filtered unpaginated scope for stats and pagination" do
       controller = TestController.new
       controller.test_resource_config = StatsResource
+      StatsModel.all_calls = 0
 
       controller.index
 
-      assert_equal 1, controller.filter_calls
+      assert_equal 1, StatsModel.all_calls
       assert_equal({ total: 37 }, controller.paginated_scope)
+      assert_equal 25, controller.pagy_limit
       assert_equal 37, controller.instance_variable_get(:@stats).second[:value]
       assert_equal :paginated, controller.instance_variable_get(:@collection)
     end

data/test/dummy/config/environments/development.rb

@@ -31,14 +31,17 @@ Rails.application.configure do
   # Print deprecation notices to the Rails logger.
   config.active_support.deprecation = :log
 
-  # Raise an error on page load if there are pending migrations.
-  config.active_record.migration_error = :page_load
+  # The dummy app can run without the Active Record railtie.
+  if config.respond_to?(:active_record)
+    # Raise an error on page load if there are pending migrations.
+    config.active_record.migration_error = :page_load
 
-  # Highlight code that triggered database queries in logs.
-  config.active_record.verbose_query_logs = true
+    # Highlight code that triggered database queries in logs.
+    config.active_record.verbose_query_logs = true
 
-  # Append comments with runtime information tags to SQL queries in logs.
-  config.active_record.query_log_tags_enabled = true
+    # Append comments with runtime information tags to SQL queries in logs.
+    config.active_record.query_log_tags_enabled = true
+  end
 
   # Highlight code that triggered redirect in logs.
   config.action_dispatch.verbose_redirect_logs = true

data/test/dummy_boot_test.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require "test_helper"
+require "open3"
+require "rbconfig"
+
+class DummyBootTest < ActiveSupport::TestCase
+  test "database-free dummy boots and eager loads in development" do
+    script = <<~RUBY
+      require_relative "test/dummy/config/environment"
+      abort "Unexpected ActiveRecord railtie" if Rails.application.config.respond_to?(:active_record)
+      Rails.application.eager_load!
+    RUBY
+    stdout, stderr, status = Open3.capture3(
+      { "RAILS_ENV" => "development" }, RbConfig.ruby, "-e", script,
+      chdir: File.expand_path("..", __dir__)
+    )
+
+    assert status.success?, "Development boot failed:\n#{stdout}#{stderr}"
+  end
+end

data/test/integration/authentication_test.rb

@@ -43,6 +43,16 @@ module AdminSuite
       end
     end
 
+    test "unknown auth strategy fails closed and lists registered strategies" do
+      with_config(allow_unauthenticated: false, auth_strategy: :typo) do
+        get ROOT
+
+        assert_response :forbidden
+        assert_includes response.body, "Unknown AdminSuite auth strategy :typo"
+        assert_includes response.body, "http_basic"
+      end
+    end
+
     test "legacy authenticate lambda still works" do
       denials = ->(controller) { controller.head :forbidden }
       with_config(allow_unauthenticated: false, auth_strategy: nil, authenticate: denials) do

data/test/integration/authorization_test.rb

@@ -66,13 +66,29 @@ module AdminSuite
       with_authorize(->(**) { false }) do
         get BASE
         assert_response :forbidden
+        refute_includes response.body, "Gadget one"
       end
     end
 
-    test "authorize receives actor, mapped action, resource, record, controller" do
+    test "nil authorize result denies with 403 and does not disclose the record" do
+      with_authorize(->(**) { nil }) do
+        get "#{BASE}/1"
+        assert_response :forbidden
+        refute_includes response.body, "Gadget one"
+      end
+    end
+
+    test "nil authorize result cannot mutate" do
+      with_authorize(->(**) { nil }) do
+        delete "#{BASE}/1"
+        assert_response :forbidden
+      end
+    end
+
+    test "authorize receives actor, mapped action, resource, record, context" do
       captured = nil
-      hook = lambda do |actor:, action:, resource:, record:, controller:|
-        captured = { action: action, resource: resource, record: record }
+      hook = lambda do |actor:, action:, resource:, record:, context:|
+        captured = { action: action, resource: resource, record: record, context: context }
         true
       end
 
@@ -83,6 +99,7 @@ module AdminSuite
       assert_equal :read, captured[:action]
       assert_equal Admin::Resources::AuthzGadgetResource, captured[:resource]
       assert_instance_of AuthzFixtures::Gadget, captured[:record]
+      assert_equal :web, captured[:context].surface
     end
 
     test "destroy maps to :destroy" do

data/test/integration/index_query_characterization_test.rb

@@ -0,0 +1,229 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+# Pins the index query path as it behaves at v0.5.0, before
+# AdminSuite::Query is extracted. These assertions intentionally exercise
+# routed requests and rendered rows rather than controller internals.
+module IndexQueryCharacterizationFixtures
+  class Relation
+    include Enumerable
+
+    attr_reader :includes_calls
+
+    def initialize(records, offset: 0, includes_calls: [])
+      @records = records
+      @offset = offset
+      @includes_calls = includes_calls
+    end
+
+    def each(&block) = @records.each(&block)
+    def count(*) = @records.length
+    def offset(value) = self.class.new(@records, offset: value, includes_calls: includes_calls)
+    def limit(value) = @records[@offset, value] || []
+
+    def where(condition = nil, *values, **bindings)
+      condition = bindings if condition.nil?
+      selected =
+        if condition.is_a?(Hash)
+          @records.select { |record| condition.all? { |field, value| record.public_send(field).to_s == value.to_s } }
+        else
+          term = (bindings[:search] || values.first).to_s.delete("%").downcase
+          fields = condition.scan(/(\w+) ILIKE/).flatten
+          @records.select { |record| fields.any? { |field| record.public_send(field).to_s.downcase.include?(term) } }
+        end
+      self.class.new(selected, includes_calls: includes_calls)
+    end
+
+    def order(ordering)
+      field, direction = ordering.first
+      sorted = @records.sort_by { |record| record.public_send(field).to_s }
+      sorted.reverse! if direction.to_sym == :desc
+      self.class.new(sorted, includes_calls: includes_calls)
+    end
+
+    def includes(*associations)
+      includes_calls << associations
+      self
+    end
+  end
+
+  class BadIncludesRelation < Relation
+    def includes(*) = raise(ArgumentError, "unknown association")
+  end
+
+  class Widget
+    extend ActiveModel::Naming
+
+    attr_reader :id, :name, :secret, :status
+
+    def initialize(id:, name:, secret:, status:)
+      @id = id
+      @name = name
+      @secret = secret
+      @status = status
+    end
+
+    ROWS = [
+      new(id: 1, name: "Zulu", secret: "hidden alpha", status: "open"),
+      new(id: 2, name: "Alpha", secret: "hidden zulu", status: "closed"),
+      new(id: 3, name: "Bravo", secret: "private", status: "open")
+    ].freeze
+    INCLUDES_CALLS = []
+
+    def self.all = Relation.new(ROWS, includes_calls: INCLUDES_CALLS)
+    def self.column_names = %w[id name secret status]
+    def self.primary_key = "id"
+    def self.columns_hash = { "id" => Struct.new(:type).new(:integer) }
+    def self.find(id) = ROWS.find { |row| row.to_param == id.to_s }
+    def to_param = id.to_s
+    def attributes = { "id" => id, "name" => name, "secret" => secret, "status" => status }
+  end
+
+  class BadIncludesWidget < Widget
+    def self.all = BadIncludesRelation.new(ROWS)
+  end
+
+  class PagedWidget
+    extend ActiveModel::Naming
+
+    attr_reader :id
+
+    def initialize(id:) = @id = id
+
+    ROWS = (1..150).map { |id| new(id: id) }.freeze
+
+    def self.all = Relation.new(ROWS)
+    def self.column_names = %w[id]
+    def self.primary_key = "id"
+    def self.columns_hash = { "id" => Struct.new(:type).new(:integer) }
+    def self.find(id) = ROWS.find { |row| row.to_param == id.to_s }
+    def to_param = id.to_s
+    def attributes = { "id" => id }
+  end
+end
+
+module Admin
+  module Resources
+    class IndexQueryCharacterizationWidgetResource < Admin::Base::Resource
+      model IndexQueryCharacterizationFixtures::Widget
+      portal :ops
+      section :observability
+
+      index do
+        searchable :name
+        sortable :name, default: :name, direction: :desc
+        filters { filter :status, type: :select, options: %w[open closed] }
+        columns do
+          column :name, sortable: true
+          column :status
+        end
+        includes :owner
+      end
+    end
+
+    class IndexQueryCharacterizationBadIncludesWidgetResource < Admin::Base::Resource
+      model IndexQueryCharacterizationFixtures::BadIncludesWidget
+      portal :ops
+      section :observability
+      index do
+        columns { column :name }
+        includes :missing
+      end
+    end
+
+    class IndexQueryCharacterizationPagedWidgetResource < Admin::Base::Resource
+      model IndexQueryCharacterizationFixtures::PagedWidget
+      portal :ops
+      section :observability
+      index do
+        columns { column :id }
+        paginate 30
+      end
+    end
+  end
+end
+
+class IndexQueryCharacterizationTest < ActionDispatch::IntegrationTest
+  WIDGETS_PATH = "/internal/admin_suite/ops/index_query_characterization_widgets"
+  PAGED_PATH = "/internal/admin_suite/ops/index_query_characterization_paged_widgets"
+
+  def rendered_names
+    css_select("tbody tr td:first-child").map { |cell| cell.text.strip }
+  end
+
+  def rendered_row_count = css_select("tbody tr").size
+
+  test "default sort applies when no sort param is given" do
+    get WIDGETS_PATH
+    assert_equal %w[Zulu Bravo Alpha], rendered_names
+  end
+
+  test "explicit sort and direction override the default" do
+    get WIDGETS_PATH, params: { sort: "name", direction: "asc" }
+    assert_equal %w[Alpha Bravo Zulu], rendered_names
+  end
+
+  test "a sort param naming an undeclared field is ignored" do
+    get WIDGETS_PATH, params: { sort: "secret", direction: "asc" }
+    assert_equal %w[Alpha Bravo Zulu], rendered_names
+  end
+
+  test "search examines only declared searchable fields" do
+    get WIDGETS_PATH, params: { search: "alpha" }
+    assert_equal [ "Alpha" ], rendered_names
+  end
+
+  test "a blank search returns the unfiltered scope" do
+    get WIDGETS_PATH, params: { search: " " }
+    assert_equal %w[Zulu Bravo Alpha], rendered_names
+  end
+
+  test "a declared filter narrows while an undeclared filter is ignored" do
+    get WIDGETS_PATH, params: { status: "open", secret: "hidden zulu" }
+    assert_equal %w[Zulu Bravo], rendered_names
+  end
+
+  test "declared includes are applied" do
+    IndexQueryCharacterizationFixtures::Widget::INCLUDES_CALLS.clear
+    get WIDGETS_PATH
+    assert_equal [ [ :owner ] ], IndexQueryCharacterizationFixtures::Widget::INCLUDES_CALLS
+  end
+
+  test "a bad includes association logs and still renders" do
+    logged = []
+    Rails.logger.stub(:warn, ->(message) { logged << message }) do
+      get "/internal/admin_suite/ops/index_query_characterization_bad_includes_widgets"
+    end
+    assert_response :success
+    assert_includes response.body, "Zulu"
+    assert_equal 1, logged.size
+  end
+
+  test "paginate 30 yields 30 rows per page" do
+    get PAGED_PATH
+    assert_equal 30, rendered_row_count
+  end
+
+  test "per_page 50 overrides the DSL value" do
+    get PAGED_PATH, params: { per_page: "50" }
+    assert_equal 50, rendered_row_count
+  end
+
+  test "an excessive per_page clamps to 100" do
+    get PAGED_PATH, params: { per_page: "999999" }
+    assert_equal 100, rendered_row_count
+  end
+
+  test "invalid and zero per_page values fall back to the DSL value" do
+    [ "abc", "0" ].each do |value|
+      get PAGED_PATH, params: { per_page: value }
+      assert_equal 30, rendered_row_count
+    end
+  end
+
+  test "a leading-zero per_page parses with Integer octal semantics" do
+    get PAGED_PATH, params: { per_page: "010" }
+    assert_equal 8, rendered_row_count
+  end
+end

data/test/integration/mcp_aggregate_test.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+module McpAggregateFixtures
+  class Widget
+    extend ActiveModel::Naming
+
+    def self.all = ReadOnlyResourceFixtures::Relation.new([new, new])
+  end
+end
+
+module Admin
+  module Resources
+    class McpAggregateWidgetResource < Admin::Base::Resource
+      model McpAggregateFixtures::Widget
+      portal :ops
+      section :observability
+      index do
+        stats { stat :total, ->(scope) { scope.count } }
+      end
+    end
+  end
+end
+
+class McpAggregateTest < McpIntegrationTest
+  def call_tool(arguments)
+    post "/internal/admin_suite/mcp",
+      params: { jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: "aggregate", arguments: arguments } }.to_json,
+      headers: { "CONTENT_TYPE" => "application/json", "HTTP_ACCEPT" => "application/json, text/event-stream" }
+    JSON.parse(response.body)
+  end
+
+  test "returns a count and declared stats without records" do
+    result = with_authorize(->(**) { true }) do
+      call_tool(resource: "mcp_aggregate_widget")
+    end
+
+    payload = JSON.parse(result.dig("result", "content", 0, "text"))
+    assert_equal 2, payload.fetch("count")
+    assert_equal 2, payload.dig("stats", "total")
+    refute payload.key?("rows"), "aggregate must never return records"
+  end
+end